Re: [quicwg/base-drafts] describe how 0-RTT is accepted and rejected (#2841)

[Kazuho Oku <[e-mail]>]

kazuho commented on this pull request.



>  
-A server rejects 0-RTT by rejecting 0-RTT at the TLS layer.  This also prevents
-QUIC from sending 0-RTT data. A server will always reject 0-RTT if it sends a
-TLS HelloRetryRequest.
+A server rejects 0-RTT by sending a ServerHello without the EarlyDataIndication.
+A server will always reject 0-RTT if it sends a TLS HelloRetryRequest.  When
+rejecting 0-RTT, a server MUST NOT process any 0-RTT packets, even if it is in
+possesion of the keys to do so.  When 0-RTT was rejected, a client MUST treat
+receipt of an acknowledgement for a 0-RTT packet as a connection error of type

@marten-seemann The spec having different packet number spaces does not necessarily mean that every QUIC stack should be having different PN counters for each number space for the packets it sends. It is entirely plausible for a QUIC stack to use just one packet number space for the packets it sends.

That said, ...

> as you point out in https://github.com/quicwg/base-drafts/pull/2841#discussion_r297128544, we're using a SHOULD elsewhere, so for consistency I changed it to a SHOULD here as well.

Thank you for the change. I appreciate it.

> I don't think that we need a "if it is able to detect the condition" sub-clause here, as the SHOULD already allows you to skip the check, if your implementation is not able to perform it.

IIRC, the sub-clause "if it is able to detect the condition" was added intentionally to the general rule, because people were concerned about the text being interpreted as to recommend having a way to detect such errors. I think the text proposed in this PR has the same problem, and my preference is to address it in the same manner.

I think that one path forward might be to, instead of clarifying the action here, incorporate the handling of acknowledgements of 0-RTT packets into the provision of 13.1.1.

I mean, changing
> An endpoint SHOULD treat receipt of an acknowledgment for a packet it did not send as a connection error of type PROTOCOL_VIOLATION, if it is able to detect the condition.

to something like:
> An endpoint SHOULD treat receipt of an acknowledgment for a packet that the server would not have processed as a connection error of type PROTOCOL_VIOLATION, if it is able to detect the condition. This includes receiving an ACK frame containing a packet number that the endpoint has not sent, as well as acknowledgements for 0-RTT packets when the server has rejected the use of 0-RTT.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2841#discussion_r297452432